airbnb/streamalert

Health v2 · maintenance only

Adoption not part of the score

2889 stars · 324 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

StreamAlert is a serverless, real-time data analysis framework from Airbnb for ingesting, analyzing, and alerting on log data from any environment using AWS Lambda, Kinesis, and Terraform. Security teams use it to scan terabytes of log data daily for incident detection and response with Python-defined rules.

Use cases

• detect security incidents in realtime log streams
• alert on suspicious activity in AWS logs
• scan terabytes of log data for threat detection
• ingest and classify logs from S3, Kinesis, and SNS
• write custom detection rules in Python
• retroactively search ingested logs for compliance

When to choose

• you need serverless realtime log analysis on AWS
• your security team wants customizable Python detection rules
• you want automated, repeatable deployment via Terraform
• you need to scale log analysis to terabytes per day

When to avoid

• you need multi-cloud or non-AWS deployment
• you want a turnkey SIEM with a UI rather than code-defined rules
• you need active community development - the project is in maintenance mode
• your log volume is small and a simpler alerting tool suffices

Facets

framework · maturity maintenance

monitoring alerting streaming etl security infrastructure-as-code security monitoring cloud-computing cloud python serverless self-hosted log-analysis incident-detection kinesis aws-lambda terraform threat-detection realtime devops data-engineering

Member repositories

For agents

markdown · JSON · MCP: product_card(name="airbnb/streamalert")